Parachute deployment system for an unmanned aerial vehicle

ABSTRACT

Disclosed is a technique for landing a drone using a parachute. The technique includes a parachute deployment system (PDS) that can deploy a parachute installed in a drone and land the drone safely. The parachute may be deployed automatically, e.g., in response to a variety of failures such as a free fall, or manually from a base unit operated by a remote user. For example, the PDS can determine the failure of the drone based on data obtained from an accelerometer, a gyroscope, a magnetometer and a barometer of the drone and automatically deploy the parachute if any failure is determined. In another example, the remote user can “kill” the drone, that is, cut off the power supply to the drone and deploy the parachute by activating an onboard “kill” switch from the base unit.

CROSS-REFERENCE TO RELATED APPLICATIONS

This application claims the benefit of U.S. Provisional Application No.62/241,572, entitled “PARACHUTE DEPLOYMENT SYSTEM FOR AN UNMANNED AERIALVEHICLE,” filed on Oct. 14, 2015, and U.S. Provisional Application No.62/344,514, entitled “PARACHUTE DEPLOYMENT SYSTEM FOR AN UNMANNED AERIALVEHICLE,” filed on Jun. 2, 2016, all of which are incorporated herein byreference in its entirety.

BACKGROUND

Unmanned aerial vehicles (UAV), such as drones, are autonomous and/orremotely operated unmanned vehicles. Drones may be configured to flyusing fixed wings or helicopter rotors and blades. There are a widevariety of errors that can occur in operation of a drone. These includepower loss, communication loss, mechanical breakage and circuit failure.Recovery from these errors includes detection of the errors and takingsteps to mitigate further damage. Under safety regulations, the UAVs arerequired to minimize any potential damage or threat to the environment,especially whilst operating above households and places with humanactivity. Should an unexpected descent occur, the vehicle descends veryfast and crashes. During such cases, descent velocity and trajectory arealso uncontrolled. The UAV's rotor blades are exposed without protectionand can potentially cause hazardous damage to the environment, e.g.,nearby infrastructures and/or people.

Some UAVs use parachutes to minimize the descent velocity and rotorblade exposure during such unexpected events. However, the parachutedeployment methods used in the current UAVs are not effective. Thedeployment methods require that the parachute be deployed manually, thepower to the drone may not be cut-off and therefore, the drone rotorsand blades may still be rotating, etc.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1A is a block diagram illustrating components of a drone,consistent with various embodiments.

FIG. 1B is a block diagram of the drone with a parachute deployed,consistent with various embodiments.

FIG. 1C is a block diagram of a base unit of FIG. 2, consistent withvarious embodiments.

FIG. 2 is a flow diagram of a process for deploying a parachute in theevent of a failure of a drone, consistent with various embodiments.

FIG. 3 is an example of an inertial measurement unit (IMU) used to buildthe attitude and heading reference system (AHRS), consistent withvarious embodiments.

FIG. 4 is a flow diagram a process for deploying the parachuteautomatically, consistent with various embodiments.

FIG. 5A shows an example of a communications subsystem having a wirelessSD shield, consistent with various embodiments.

FIG. 5B shows an example of a communications subsystem having an XBeeradio transceiver, consistent with various embodiments.

FIG. 6A shows an example of a 2500 mAh battery used in the drone,consistent with various embodiments.

FIG. 6B shows an example of a voltage regulator used in the drone,consistent with various embodiments.

FIG. 6C shows an example of a battery charger used in the drone,consistent with various embodiments.

FIG. 7 shows an example of a parachute that can be employed in aparachute deployment system (PDS) of the drone, consistent with variousembodiments.

FIG. 8 shows examples of different types of parachutes that can beinstalled on the drone, consistent with various embodiments.

FIG. 9A shows a logic table for the input states of the analoguemultiplexers, consistent with various embodiments.

FIG. 9B shows a pin diagram for the analogue multiplexers, consistentwith various embodiments.

FIG. 10 shows a schematic for the circuit for shutting off the motorsinstantly, consistent with various embodiments.

FIG. 11 is a block diagram illustrating an example for breaking anelectrical connection between an auto pilot system of the drone and anelectronic speed controller (ESC) of a lift mechanism of the drone,consistent with various embodiments.

FIG. 12 is a block diagram illustrating an example for breaking anelectrical connection between the ESC and motors of the lift mechanismof the drone, consistent with various embodiments.

FIG. 13, is a block diagram illustrating an example for cutting-off thepower supply to the motors of the lift mechanism of the drone,consistent with various embodiments.

FIG. 14 shows a first design for a rotor protection shroud (RPS),consistent with various embodiments.

FIG. 15A shows a result of the stress analysis of the RPS designed basedon the first design of FIG. 14, consistent with various embodiments.

FIG. 15B shows a result of the deflection analysis of the RPS designedbased on the first design of FIG. 14, consistent with variousembodiments.

FIG. 16 shows a second design for the RPS, consistent with variousembodiments.

FIG. 17A shows the result of stress analysis of the RPS designed basedon the second design of FIG. 16, consistent with various embodiments.

FIG. 17B shows the result of deflection analysis of the RPS designedbased on the second design of FIG. 16, consistent with variousembodiments.

FIG. 18 shows a 3D printed model of the RPS based on the second design,consistent with various embodiments.

FIG. 19 shows a third design for the RPS, consistent with variousembodiments.

FIG. 20A shows the result of stress analysis of the RPS designed basedon the third design of FIG. 19, consistent with various embodiments.

FIG. 20B shows the result of deflection analysis of the RPS designedbased on the third design of FIG. 19, consistent with variousembodiments.

FIG. 21 is a flow diagram of a process for a motorized descent of thedrone with the parachute ejected, consistent with various embodiments.

FIG. 22 is a flow diagram of a process for activating audio-visualindicators on a descending drone, consistent with various embodiments.

FIG. 23 is a block diagram of a computer system as may be used toimplement features of the disclosed embodiments.

DETAILED DESCRIPTION

Disclosed is a technique for landing a UAV, such as a drone, using aparachute. The technique includes a parachute deployment system (PDS)that can deploy a parachute installed in a drone and land the dronesafely. The parachute may be deployed automatically, e.g., in responseto any of a number of errors/failures such as a free fall, or manually,e.g., from a base unit operated by a remote user. In some embodiments,the PDS can determine the failure of the drone based on any of (a) dataobtained from an accelerometer, a gyroscope, a magnetometer and/or abarometer of the drone, (b) a geo fence breach, (c) a lack of heartbeatsignal from an autopilot system (also referred to as a flightcontroller) which can indicate that the auto pilot system has ceased tofunction, and automatically deploy the parachute if any failure isdetermined. In some embodiments, the remote user can “kill” the drone byactivating an onboard “kill” switch via the base unit. When the on board“kill” switch is activated, the “kill” switch kills the drone, that is,controls a lift mechanism of the drone, e.g., commanding motors of thedrone to brake (e.g., commanding the motors to free spin, to activelybrake, or substituting a throttle signal to the lift mechanism with azero throttle command), and deploys the parachute. The base unit can bea hand held unit such as a remote controller that can perform radiocommunication with the drone or, in some embodiments, can be a part ofthe Ground Control Station software for the nominal operation of thedrone itself or a fleet of drones. The ground control station can besoftware, hardware or a combination thereof that facilitates inoperating the drone or a fleet of drones from a remote location.

In some embodiments, when the parachute is deployed, regardless ofwhether it is deployed automatically or manually, the PDS is configuredto control the motors, e.g., stop rotor blades of the drone fromrotating, thereby avoiding any damage that can be caused to the drone orthe environment by the rotor blades which can still be rotatingotherwise in the event of a failure. While the PDS can control themotors by sending a “BRAKE” signal to the motors, the PDS can alsocut-off power supply to the drone, e.g., to a drivetrain of the drone,when or prior to the parachute is deployed. In some embodiments, whilethe power to drivetrain is cut-off the full functioning of theunaffected avionics is retained. The PDS can also cut-off the powersupply from the drone's battery to the entire drone in a “master kill”mode. In some embodiments, the electrical connections that provide powersupply to the motors can be cut-off to disable the motors permanently.Each of the above cut-off methods can be used in addition to oralternative to multiplexing the “BRAKE” signal to the motors forcontrolling the motors. In some embodiments, the PDS can use dronetelemetry to activate the parachute instead of the separatetelecommunications module.

The PDS has a number of other features. In some embodiments, the PDSoperates independent of the drone. For example, the PDS can have its ownpower supply which is different from the power supply of the drone. Insome embodiments, the PDS can be powered using the drone battery but canhave a standalone battery as a backup. In another example, the PDS canhave its own communications link which, when activated, shuts down thedrone. The PDS can also facilitate steering the deployed parachute. Thesteerable parachute can have an integrated sensor system (e.g., visual,LIDAR, radar, laser, sonar) that facilitates autonomous decision makingfor avoiding obstacles and landing the drone at the least damaginglocation. The parachute can also be steered manually by a remoteoperator using the base unit. This sensor system may also act as apassive guidance aid to the remote operator who ultimately issues thecommands in order to land the drone safely using the steerableparachute. The PDS can also support installing and deploying of multipleparachutes, e.g., for controlling the descent velocity more effectively.In some embodiments, the PDS uses different sized and shaped parachutes.

The PDS can activate the parachute using a variety of means. Forexample, the PDS can activate the parachute through a servo. In someembodiments, a servomotor is a rotary actuator or linear actuator thatallows for precise control of angular or linear position, velocity andacceleration. The servomotor consists of a suitable motor coupled to asensor for position feedback. The servo can be powered using anindependent power source, e.g., the same as the one used to power theerror detection circuit 120 or another independent power source. Theservo can activate one or more shroud lines of the parachute 125. Inanother example, the PDS can use a carbon dioxide (CO₂) deploymentsystem, a fuse ejection system or a magnetic release to deploy theparachute. The PDS can use a drogue parachute for quicker deployment.

FIG. 1 is a block diagram illustrating components of a drone 100,consistent with various embodiments. The drone 100 includes a liftmechanism 110 configured to lift and propel the drone. The liftmechanism 110 may include elements configured to provide thrust as wellas lift. Examples of the lift mechanism 110 can include rotors of arotorcraft, wings of fixed wing aircraft, lighter than air containers ofaerostats (lighter-than-air aircrafts) and any hybrid combinationthereof. The rotorcraft can utilize any number of rotor blades toprovide lift and thrust throughout the duration of flight of the drone100. Common examples of rotorcraft include helicopters which primarilyuse a single variable pitch rotor blade; and multi-rotors which use twoor more typically fixed-pitch rotor blades to generate lift and thrust,and control attitude.

A fixed wing aircraft can generate lift through the wings based on theforward velocity of the aircraft, usually generated by thrust. Theforward velocity can be generated using rockets, propellers and/orvarious types of jet engines. The flight control surfaces, often on thewings, allow changes in attitude. The forward thrust propulsion can begenerated using propeller engines, jet engines, rocket engines, ramjetengines or any combination thereof. The methods of powering theseengines can include carbon-based methods like petroleum or natural gas,electricity (generated on the go through solar panels or stored inbatteries) and hydrogen cells.

The aerostats can rely on the use of a buoyant gas to generate lift.Common examples of aerostats include hot air balloons, which haveuncontrolled attitude and forward thrust direction, and airships whichutilize a propulsion engine to control forward thrust.

Hybrid combinations include the tilt wing and tiltrotor aircraft whichchange the tilt of the wing and the rotor respectively in order to allowthe aircraft to use the same propulsion engines for vertical take-offand hovering as well as for forward thrust propulsion.

The drone 100 includes a flight controller 115 (also referred to as anauto pilot system) configured to control the drone 100 in flight. Theflight controller 115 can be directly responsible for controlling allthe mechanisms of flight and/or components of the drone 100 based eitheron input from a pilot over a remote connection, or from integratedonboard circuitry designed to autonomously control the drone. The flightcontroller 115 can have direct control over the lift mechanism 110(e.g., thrust, tilt) and any flight control surfaces. The flightcontroller 115 can control the lift mechanism 110 for taking off thedrone 100, flying the drone 100, and/or landing the drone 100. Theflight control 115 can control the lift mechanism 110 in various ways,e.g., starting one or more motors of the lift mechanism 110, stoppingone or more motors, increasing and/or decreasing the speed of rotationof one or more motors, and performing one or more of the aboveoperations in a specified sequence or pattern among the one or moremotors. In some embodiments, the flight controller 115 can beprogrammed, e.g., using onboard logic or circuitry, with somerestrictions for the flight of the drone 100. For example, the flightcontroller 115 can be programmed to keep the drone 100 within aspecified altitude, e.g., 400 feet. In another example, the flightcontroller 115 can be programmed to keep the drone 100 within aspecified perimeter.

The drone 100 includes an error detection circuit 120 configured todetect errors in operation of the drone 100 and generate a trigger eventin response to the error detection. The various types of errors includenavigation loss of the drone 100, communication loss with a groundcontrol station, heartbeat loss—lack of heartbeat signal from the autopilot system or a flight controller, power being below a specifiedthreshold or power loss of one or more power sources, impact of thedrone 100, gyro error, motor control, geo-fence breach, loss inaltitude, sudden drop, inversion, fire, video loss, tilt, etc. In someembodiments, the error detection circuit 120 is configured to receive aheartbeat signal from the auto pilot system or the flight controller,which indicates that the auto pilot system is functioning as expected,at predefined intervals. If the error detection circuit 120 does notreceive the heartbeat signal at the predefined intervals, the errordetection circuit 120 can determine that there is an heartbeat loss,which indicates a problem with the auto pilot system. In someembodiments, the error detection circuit 120 can determine an error dueto an impact on collision of the drone 100 with an object or a humanbeing. Occurrence of one or more of these errors can result in a failureof the drone 100. The error detection circuit 120 can then generate atrigger event in response to the detection of the error, which in turncan cause the PDS 190 of FIG. 1B (described in additional detail atleast with respect to FIG. 1B) to deploy the parachute 125automatically. In some embodiments, the error detection circuit 120 canuse one or more sensors on board the drone 100 or in the PDS 190 todetermine an error. The error detection circuit 120 can analyze the datafrom these sensors and determine whether an error has occurred. Further,a user can specify the errors for which the parachute 125 is to bedeployed, e.g., one or more of the above described errors.

The drone 100 includes a parachute 125 securely attached to the drone100 and configured to slow the decent of the drone 100 when theparachute 125 is deployed. The parachutes can be of type A or type B(described below at least with reference to FIG. 8). They can bedeployed using various means, e.g., ballistic means, using servo, usingcompressed gas, using CO₂ gas cylinder, pyrotechnics, or it can be aspring loaded parachute. The parachute 125 can also be a steerableparachute, which can be steered by a remote operator from a base unit,e.g., a hand-held remote control, or completely autonomously usingonboard or remote logic. The parachute 125 can be of various sizes. Aparticular size can be selected as a function of the weight of the drone100. The parachute 125 can be securely attached to the drone 100 bybeing permanently attached or removably attached to the drone 100.

The drone 100 includes a parachute deployment mechanism 130 configuredto release/deploy the parachute 125, e.g., in response to the triggerevent from the error detection circuit 120. The parachute deploymentmechanism 130 can also be configured to be manually activated by aremote user using a base unit operated by the remote user. In someembodiments, the parachute deployment mechanism 130 can automaticallyrelease the parachute 125 in response to detection of errors, such as atilt of the drone 100 exceeds a specified number of degrees from thehorizontal, has exceeded the tilt for a specified duration, is above aminimum altitude, the drone 100 is falling at a speed that exceeds auser-defined value, and/or if the drone 100 has breached a hard globalpositioning system (GPS) defined geo-fence.

The drone 100 includes a power source 135 configured to power the drone100, e.g., the lift mechanism 110 and the error detection circuit 120.The power source 135 can include multiple power sources, e.g., a firstpower storage device 140 a for providing power to the lift mechanism 110and an independent second power storage device 140 b for providing powerto the error detection circuit 120. While the second power storagedevice 140 b can power the parachute deployment mechanism 130 as well,in some embodiments, the parachute deployment mechanism 130 can alsohave an independent power source.

The drone 100 includes a communication system 150 that can facilitate aremote user to communicate with the drone 100, e.g., for steering thedrone 100, for issuing any other commands to the drone 100 or receivinginformation from the drone 100. In some embodiments, the remote user cancommunicate with the drone 100 using a base unit, which can be ahand-held unit, that is capable of transmitting data to and receivingdata from the drone 100, e.g., via radio or satellite communication. Thecommunication system 150 can include a two-way radio to communicationwith the base unit 195 and/or ground control station. For example, thecommunication system 150 can communicate a status of the error detectioncircuit 120, e.g., details of detected errors, to the remote operator105 at the base unit 195. In some embodiments, the communication system150 provides diverse, redundant, and persistent communications for (a)command/control of the drone 100, and (b) communicating voice/databetween the drone 100 and the base unit or ground control station. Insome embodiments, the communication system 150 can include “aviationgrade” communications for integration of UAVs within commercialenvironments and airspace.

The drone 100 includes a cut-off circuit 155 that can control thefunctioning of the lift mechanism 110 of the drone 100. For example, thecut-off circuit 155 can disable or stop the motors momentarily orpermanently in response to detection of an error so that a parachute canbe deployed automatically. The cut-off circuit 155 can include a “kill”switch, e.g., kill switch 193 of FIG. 1B, that is triggered when theerror detection circuit 120 detects a failure of the drone 100. The“kill” switch controls the lift mechanism 110, e.g., disables or stopsthe motors momentarily or permanently. For example, the kill-switch canstop or disable the motors temporarily by braking the motors and/orcutting off the power supply to the motors causing the motors free spin,cutting off the power supply to motors by grounding the signal to themotors, by substituting the throttle signal from the flight controllerto the lift mechanism 110, e.g., to the electronic speed controller(ESC) of the lift mechanism 110, with a zero throttle command from thePDS. In some embodiments, the lift mechanism 110 is controlledmomentarily to allow the parachute 125 to be deployed. In anotherexample, the kill switch 193 can stop or disable the motors permanentlyby cutting of the electrical connections to the motors. Other methodsfor disabling the lift mechanism 110 are also possible some of which aredescribed below at least with reference to FIGS. 11-13.

In some embodiments, the failure of the drone 100 can be detected usingthe error detection circuit 120. In deploying the parachute 125, eitherthe parachute 125 can be deployed first and then the motor becontrolled, e.g., shut off, or the motor be controlled first and thenthe parachute 125 be deployed, or they can be done simultaneously. Insome embodiments, the parachute 125 is automatically deployed when themotor is shutoff, e.g., the lift mechanism 110 is disabled. For example,the parachute deployment mechanism 130 can detect that the liftmechanism 110 is powered off and release the parachute 125 accordingly.In some embodiments, the lift mechanism 110 is controlled before theparachute 125 is deployed. Additional details with respect tocontrolling the lift mechanism 110 is described below.

The drone 100 includes a navigation circuit 160 that facilitates in thenavigation of the drone 100. The navigation circuit 160 can haveinstructions such as a location where the drone 100 is to travel, etc.

The drone 100 includes a video system 165 that facilitates to capture animage, an audio clip, and/or a video clip of various targets from thedrone 100. In some embodiments, the video system 165 can transmit thecaptured data to a remote user, e.g., in real time. In some embodiments,the video system 165 can store the captured data on a storage deviceinstalled in the drone 100 or store in a storage device at a remotelocation defined by the remote user. In some embodiments, the drone 100includes a video camera installed on a downward facing gimbal forproviding a video of the landing area to land the drone 100.

The drone 100 includes a security circuit 170 that facilitates inpreventing unauthorized interference with the command and control of thedrone and the PDS, such as hacking of the control datalinks between thedrone and the base unit, e.g., Ground Control Station.

The drone 100 includes a parachute controller 175 that facilitates insteering the parachute 125 when the parachute 125 is deployed. Theparachute can be steered automatically, or manually by an operator usingthe base unit. In some embodiments, the parachute controller 175 cansteer the parachute 125 automatically using integrated sensors, e.g.,video feed, sonar, radar, LIDAR, computer vision, infra-red, nearinfra-red (NIR), Thermal, sonic, of the drone 100 and/or the PDS, andusing a logic system of the PDS that facilitates in avoiding obstaclesand landing the drone at the safest available location or a specifiedlocation. For example, the parachute controller 175 can communicate withthe video system 165 to monitor the environment around the drone 100 andfacilitate in landing the drone at the safest available location in theevent of the failure of the drone 100. These sensors may be a completelydiscrete system as part of the parachute controller 175 or it may makeuse of the suite of sensors that are still operable on the drone 100. Inanother example, the parachute 125 can be steered manually by anoperator from the base unit, e.g., using a live video feed from thedrone 100 or directly if the drone 100 is in a line of sight of theoperator.

Steering the parachute 125 can be achieved in various ways. For example,the parachute 125 can steer itself using a set of servos or actuators,e.g., guided by a secondary auto pilot system linked to the PDS that isindependent of the autopilot system of the drone 100, that lengthenand/or shorten control cables modifying the shape of the parachute 125so as to effect pitch/roll/yaw control. In another example, one or morefans can be used to steer the parachute 125. In another example, pullcords of the parachute 125 can be used to steer the parachute 125.

The drone 100 includes an airbag deployment module 180 that deploys anairbag so that a damage that can be caused to the drone 100 or theenvironment where the drone 100 lands is minimized. The airbagdeployment module 180 can be implemented in a number of ways. In someembodiments, the airbag deployment module 180 includes a safety assemblyhaving a pressurized gas tank (or a chemical which when activatedcreates a controlled chemical explosion which generates gas) and one ormore inflatable airbags connected to the gas tank through valve one ormore valves. The tank may be controlled by a sensor device or receive acommand to cause inflation of the air bag. The airbag deployment module180 can also include a pressurized gas tank (or a chemical which whenactivated creates a controlled chemical explosion which generates gas)mounted on the drone 100. The airbag deployment module 180 includes oneor more valves connected on one side of the pressurized gas tank atappropriate locations, and each valve is connected at its other side toat least one associated inflatable airbag. When the pressurized gas tankis filled with a gas at an appropriate pressure (or when the chemical isactivated to create a controlled chemical explosion which generates gas)any sensor which may detect a forthcoming impact or receive a commandwhich may be sent by a computer onboard the drone 100 or off board thedrone 100, which causes the valve to open with the result of aninstantaneous inflation of the air bags, due to the high gas pressurewithin the tank. The airbags can deploy at the exterior of the drone 100causing a cushion against any impact with persons or property. In someembodiments, the above techniques can also be used to inflate theparachute 125.

The drone 100 can be deployed to perform one or more applications, e.g.,surveillance of illegal activities to safeguard civil security,anti-poacher operations, forest fire fighting, monitoring floodingstorms & hurricanes, traffic monitoring, radiation measurement,searching for missing persons, monitoring harvesting. The drone 100 caninclude an application module 185 that facilitates the drone 100 inperforming a specified user-defined application. The application module185 can include the instructions for the drone 100 to perform thespecified user-defined application.

Note that the drone 100 illustrated in FIG. 1 is not restricted tohaving the above modules. The drone 100 can include lesser number ofmodules, e.g., functionalities of two modules can be combined into onemodule. The drone 100 can also include more number of modules, e.g.,functionalities performed by a single module can be performed by morethan one module, or there can be additional modules that perform otherfunctionalities. Further, the functionality performed by a moduledescribed above can be performed by one or more of the other modules aswell.

FIG. 1B is a block diagram of the drone 100 with a parachute 125deployed, consistent with various embodiments. The drone 100 includesthe PDS 190 that facilitates deploying the parachute 125. The PDS 190can deploy the parachute 125 automatically, or in response to a commandissued by a remote operator 105 via a base unit 195. In someembodiments, the PDS 190 includes a “kill” switch 193 that, whentriggered, controls the lift mechanism 110, e.g., brakes the motorsand/or cuts off the power supply to the motors, and indicates theparachute deployment mechanism 130 to deploy the parachute 125. The killswitch 193 can be powered using an independent power source. The killswitch 193 can be activated by the remote operator 145 via the base unit195. In some embodiments, the base unit 195 can send the command to thekill switch 193 over an encrypted communications channel. Note that thePDS 190 can be a combination of one or more modules/circuits/componentsof the drone 100 illustrated in FIG. 1, or can include additionalmodules, all of which together facilitate deployment of the parachute125.

FIG. 1C is a block diagram of the base unit of FIG. 2, consistent withvarious embodiments. As described above, the base unit 195 can be a handheld unit such as a remote controller that can perform radiocommunication with the drone. In some embodiments, the base unit can bea part of the ground control station software. The base unit 195 iscapable of performing radio and/or satellite communications with thedrone 100. The base unit 195 can include a deploy switch 196, e.g., apush-button, that can send a signal to the onboard “kill” switch 193 onthe drone 100 that, when activated, causes the drone 100 to deploy theparachute 125. The base unit 195 can include an auto deployment switch197, e.g., DIP switch, for enabling or disabling auto deployment of theparachute 125 on the drone 100 in response to a failure of the drone100. The base unit 195 can include a communications system 198, e.g.,Xbee 900HP, for sending and receiving instructions from the drone 100.The base unit 195 can include an arming switch 199, e.g., flip switch,for enabling or disabling manual deployment of the parachute 125 fromthe base unit 195.

FIG. 2 is a flow diagram of a process 200 for deploying a parachute of adrone of FIG. 1, consistent with various embodiments. The process 200can be performed using the drone 100 of FIG. 1. At block 210, thenavigation circuit 160 facilitates in navigating the drone 100 to one ormore locations. In some embodiments, the navigation circuit 160 receivesthe instructions for navigating the drone 100 from a base unit operatedby a remote user, which is capable of performing radio and/or satellitecommunications with the drone 100.

At block 215, the error detection circuit 120 detects an error. Forexample, the error can be navigation loss, communication loss, powerloss, impact, gyro error, motor control, sudden drop, inversion, fire,video loss, heartbeat loss, lack of electrical signal from errordetection circuit, affirmative release of parachute electrical signal,the drone 100 exceeds a specified number of degrees from the horizontal,has exceeded the tilt for a specified duration, is above a minimumaltitude, is falling at a speed that exceeds a user-defined value,and/or if it has breached a hard GPS defined geo-fence.

At block 220, the error detection circuit 120 classifies the error intoa particular error type. In some embodiments, the parachute 125 isautomatically deployed only if the error is of one or more specifiedtypes. The error types to which the parachute 125 is to be deployed canbe specified by the user, e.g., as described above. For example, theheartbeat loss or the geo fence breach are some of the error types towhich the parachute 125 is to be deployed.

In an event the error is classified into one of the specified errortypes, at block 225, the error detection circuit 120 generates a triggerevent instructing the cut-off circuit 155 to control the lift mechanism110. In some embodiments, the cut-off circuit 155 controls the liftmechanism 110 by disabling the lift mechanism 110 as described above.

In some embodiments, prior to controlling the lift mechanism 110, theerror detection circuit 120 determines whether it is safe to deploy theparachute 125 based on safe deployment parameters such as minimumaltitude to deploy the parachute 125. If the safe deployment parametersare not met, the parachute 125 is not deployed and therefore, the liftmechanism 110 is not disabled. The checking against the safe deploymentparameters may be overridden by the remote operator 105 manually via thebase unit 195.

At block 230, the parachute deployment mechanism 130 deploys theparachute 125 automatically, e.g., upon detecting that the liftmechanism 110 is controlled. Note that the steps of blocks 225 and 230can be performed in any order or in parallel.

At block 235, the communication system 150 can send a signal back to thebase unit 195 confirming the deployment of the parachute 125. In someembodiments, the warning lights or audible signals onboard the drone 100linked to the PDS 190 can also be activated.

At block 240, the parachute controller 175 facilitates steering theparachute 125 to land the drone 100 at the least damaging location,e.g., at the safest available location. The parachute 125 can be steeredmanually by the remote operator 105 from the base unit 195, e.g., guidedby the onboard video feed, or can be steered automatically towards thesafest landing point as described above. For example, the PDS 190 useseither its own discrete set of onboard sensors, e.g., as describedabove, or requests the same from the sensors that are normally used bythe drone 100 for situation awareness purposes to first identify allclear landing areas within the drone's current projected glide path,taking into account prevailing wind, other atmospheric conditions aswell as the mass and velocities of the aircraft at the time ofdeployment. These landing areas can be identified according to a set ofpredefined parameters, e.g., a size of obstructions, lack ofobstructions along the glide path as well as a level surface and aminimum distance from identified manned activities on the ground such ascrowds, children, animals. These may then be ranked by the logic on thePDS 190, e.g., in a risk matrix driven process, that produces the safesteligible landing point that has a high confidence of attaining under theprevailing conditions. In some embodiments, the remote operator 105monitoring the drone 100 will have full override capabilities as a finalcheck in the system and will be presented visually with the same set ofchoices and can instruct an alternate if necessary. The PDS 190 thensteers the drone 100 by manipulating the control lines to the parachute125 toward the desired landing spot.

At block 245, the communication system 150 can communicate the detailsof the error to the remote operator 105, e.g., at the base unit 195operated by the remote operator 105 or any other device that is capableof communicating with the drone 100. In some embodiments, the processdescribed with reference to block 245 can be performed prior to theblock 230.

At block 250, the communication system 150 can communicate the locationwhere the drone 100 landed to the remote operator 105, e.g., at the baseunit 195 operated by the remote operator 105 or any other device that iscapable of communicating with the drone 100.

In some embodiments, if the parachute 125 is deployed automatically,e.g., when the remote operator 105 activates the onboard “kill” switch193 using the base unit 195, then the process described with referenceto blocks 225-250 may be performed.

Those skilled in the art will appreciate that the logic illustrated inthe flow diagram discussed above, may be altered in various ways. Forexample, the order of the logic may be rearranged, substeps may beperformed in parallel, illustrated logic may be omitted; other logic maybe included, etc. In some embodiments, the steps of 215 and 220 may notbe performed, e.g., when the user manually kills the drone 100, that is,cuts-off the power supply to the drone 100 and deploys the parachute 125by activating the onboard kill switch from the base unit.

The disclosed embodiments include two components—the PDS and a rotorprotection shroud (RPS) each of which are discussed in detail in thefollowing paragraphs.

Parachute Deployment System (PDS)

The PDS 190 can be a combination of one or more modules of the drone 100illustrated in FIG. 1. In case of a system failure in the drone 100, thedrone 100 needs to be able to land as safely as possible. The PDS 190deploys a parachute 125 that can safely land the drone 100. In someembodiments, the PDS 190 is configured to:

-   -   1. support no less than a specified weight, e.g., 4 kg, with a        specified maximum rate of descent, e.g., approximately 4 m/s;    -   2. be completely self-powered;    -   3. be manually triggered remotely;    -   4. cut-off power supply to the drone 100; and    -   5. automatically detect failure.

In some embodiments, the PDS 190 is configured to include communicationsfor manual activation, microcontroller for logic, parachute 125, power,and an Inertial Measurement Unit (IMU) (needed for automaticdeployment). In some embodiments, each of these is fairly modular, andcan be replaced with a similar system (e.g., a PDS using an XBee forcommunications can be replaced with any other Arduino-compatibletelecommunication system).

In some embodiments, the PDS 190 and the RPS are integrated to the drone100 considering the amount of weight added, and the mass and inertialbalance of the vehicle, and the perturbation of aerodynamic effects thePDS 190 and the RPS introduce. The embodiments also minimize changes tothe aerodynamic behavior of the drone 100 compared to the aerodynamicbehavior without the PDS 190 and the RPS.

Automatic Failure Detection

The PDS 190 is configured to be able to automatically detect a failure,cutoff the drone power circuitry and deploy the parachute 125. In someembodiments, the automatic detection of failure will trigger when thedrone 100:

-   -   exceeds a specified amount of tilt, e.g., 25 degrees, from the        horizontal;    -   has exceeded the specified amount of tilt for a specified        period, e.g., 2 seconds;    -   is above a specified minimum altitude; and    -   is falling at a specified speed, e.g., 5 m/s.

After the failure is detected, the PDS 190 can deploy the parachute 125,and send a signal to disable the motors, e.g., of the lift mechanism110. In some embodiments, the signal to disable the motors can be sentfirst and then the parachute 125 can be deployed. However, variousconfigurations of deployment are possible. Further, the failure can betriggered by various other factors.

The above triggering conditions stem from several factors, and aredetermined to be the characteristics of the drone under abnormalbehavior. Under normal operations, the drone 100 can always be orientedas horizontally as possible—ideally zero. The necessary pitch and rolltilts that may be required to navigate the drone 100 is usually aspecified range, e.g., below 10 degrees and not exceeding 25 degrees.Hence, it may be deemed that failure has occurred if the tilt is outsideof the specified range. Nevertheless, due to the noise of the sensorreading, it can be dangerous to claim a failure, deploy the parachute125, and shut off the motors whenever a tilt greater than 25 degrees isdetected—it may simply be due to a noisy spike in the IMU sensor datasignal. The tilt may also be caused by a short momentary disturbance ofair flow, which may disturb the balance of the drone for a fewmilliseconds, but would calm before the drone loses its control. Hence,in some embodiments, it is deemed that a tilt should be monitored for aspecified duration, e.g., 2 seconds. The PDS 190 can determine that atilt of more than 25 degrees on duration of more than 2 seconds signalsa high probability of system imbalance and failure, and therefore deploythe parachute 125 and shut off the motor automatically. This specifiedduration can be user specified and be easily changed by the user.

In some embodiments, the minimum altitude for deploying the parachute125 can be determined based on local regulatory authorities. Thespecified speed at which the drone 100 is falling is also determined tobe an indicator of system failure, and is typically greater than normaldescend velocity, which is usually at a much milder rate.

Furthermore, one of the common points of failures can lie in a flightcontroller, e.g., Arducopter/Pixhawk controller. Not only will this willresult in the motors actuating in an uncontrolled manner while the droneis falling, a more severe problem is that a flight controller failureimplies the inability of the inbuilt PDS to be triggered correctly. Assuch, the failure detection system (e.g., error detection circuit 120)has to be self-powered and independent/modular. Therefore, the inbuiltPDS of the flight controller cannot be used. The power design of thefailure detection system is further discussed in latter sections.

In some embodiments, the microcontroller used is the Arduino Uno orsmaller versions of the Arduino like the Nano. In some embodiments, themicrocontroller is built using a custom made printed circuit board(PCB), e.g., to minimize the weight and volume that the PDS 190 wouldtake on a drone. The specifications of the Arduino Uno are:

TABLE 1 Arduino Uno Specifications Microcontroller ATmega328 OperatingVoltage  5 V Digital I/O Pins 14 (of which 6 provide PWM output) AnalogInput Pins  6 Flash Memory 32 KB EEPROM  1 KB SRAM  2 KB Clock Speed 16MHz

As the above ATmega328 microcontroller is used on the Arduino Uno for onboard processing, it is of great advantage to use products compatiblewith Arduino such as the L3GD20H (3-axis gyroscope), LSM303 (3-axiscompass and 3-axis accelerometer), in order to accomplish an AHRS(Attitude and Heading Reference System). These modules are greatlysupported in the Arduino community, which simplifies the design andintegration. In some embodiments, for automatic failure detectionsystem, Adafruit's 10 DOF IMU break-out board is used. The Adafruit's 10DOF IMU break-out board consists of the above modules (L3GD20H & LSM303)as well as a barometer (BMP180) for relative altitude measurements andhas the necessary on-chip processing capabilities to lessen thecomputational load on the on-board computer.

The IMU module has 10 degrees of freedom, 3 each for accelerometer,compass (magnetometer) and gyroscope, and 1 for altitude. FIG. 3 is anexample of an IMU used to build the AHRS, consistent with variousembodiments. The IMU of FIG. 2 has high accuracy sensor readings andon-board processing capabilities.

The AHRS can be built from the 10 DOF IMU in two ways. The first way isto utilise the gyroscope alone, to provide the three euler angles—roll,pitch, and yaw—after the angular rate sensor data is passed through afirst order integration algorithm, in order to obtain the angularpositions. However, the gyroscope can suffer from two maindisadvantages—gyroscopic drift and gimbal locks. The gyroscopic drift isa phenomenon of a static or dynamic shift in estimated attitudereadings. This can be caused by two reasons—the first being an inherentdrift in the gyroscopic sensor, and the second being the result ofintegrating noisy signals over time. The gimbal locks disadvantage is amathematical and physical one, where the euler angle measurementsprovided by the gyroscope suffers from the gimbal locks when the roll orpitch is ±90°. These issues can be resolved, however, with many advancedalgorithms available from the IMU community.

Nevertheless, a second approach to build the AHRS can be to takeadvantage of the earth's magnetic field and gravitational field, inorder to bypass resolving all the above problems with the gyroscope. Ona hovering aircraft, a tilt in the roll and pitch direction will beregistered as a change in experienced g-force by the accelerometer inthe x and y direction respectively, which can be used to deduce theamount of tilt in each direction. The IMU can have this simple algorithmbuilt in to the break out board, so that roll and pitch readings can bereadily obtained from the accelerometer. Unlike the gyroscope, this isnot a relative measurement, but an absolute one—the reading willregister as zero if there is no tilt (the drone does not feel a strongerpull on either side of its body if it is horizontal), hence this methodimmediately removes the problem of drift. Note that the accelerometercannot measure yaw, since the g-force experienced by the drone isinvariant under yaw rotations.

To measure the yaw angular position, the on-board compass, ormagnetometer, can be used to measure the direction of the earth'smagnetic field. Provided that the drone does not fly across time zonesand continents, the direction of the earth's magnetic is constantthroughout the drone's journey and can be used as a reference to thedrone's heading, or yaw, direction. Of course, this may require aninitial knowledge of where the earth's magnetic field is pointingthroughout an area of interest. This is a well-documented piece ofinformation that can be looked up. Like the accelerometer, themagnetometer reading is absolute, and does not suffer. This reading canbe accurate, unless a magnet is nearby—a phenomenon that may not usuallyexpected in mid-air.

With this second approach, the AHRS will provide a more accurate,driftless reading for the drone. Note that, however, the attitude datais still represented by eular angles, so that gimbal locks are stillpresent. Nevertheless, this may not be an issue, as long before the UAVwould hit a tilt of ±90°, the PDS 190 would have deployed the parachute125 and shut off the motors.

With the accelerometer and compass to serve as secondary sensors forattitude determination, this IMU can provide a low cost AHRS module.With this sensor reading, the above failure detection criteria can beimplemented, e.g., in software.

A barometer can be used for determining the failure based on the thirdfailure criterion—whether the drone 100 is above a specified minimumaltitude. The PDS 190 would need to initialize the barometer to a setlevel and use relative measurements after that.

FIG. 4 is a flow diagram a process 400 for deploying the parachute 125automatically, consistent with various embodiments. The process 400 canbe implemented using the drone 100. At block 405, the error detectioncircuit 120 detects an error. The error detection circuit 120 determinesa type of the error. In some embodiments, the parachute 125 isautomatically deployed only if the error is of specified types. Theerror types to which the parachute 125 is to be automatically deployedcan be defined by a user.

At decision block 410, the error detection circuit 120 determines if theerror is due to a tilt of the drone and if the tilt of the drone exceedsa first threshold, e.g., 25 degrees. If the tilt does not exceed thefirst threshold, the process 400 returns, that is, the parachute 125 isnot deployed. On the other hand, if the tilt exceeds the firstthreshold, at decision block 415, the error detection circuit 120determines if the duration of the tilt exceeds a second threshold, e.g.,2 seconds. In some embodiments, a short-duration event may not triggerrelease of the parachute (e.g., downdrafts, temporary loss of lift). Ifthe duration of the tilt does not exceed the second threshold, theprocess 400 returns. On the other hand, if the duration of the tiltexceeds the second threshold, at decision block 420, the error detectioncircuit 120 determines if the altitude at which the drone 100 is flyingexceeds a minimum altitude, e.g., 20 feet. If the drone 100 is flyingbelow the minimum altitude to deploy a parachute, the process 400returns. On the other hand, if the drone 100 is flying above the minimumaltitude, at block 425, the on-board kill switch of the cut-off circuit155 is activated. The on-board kill switch controls the lift mechanism110, e.g., disables the motors of the lift mechanism 110 as describedabove. After the lift mechanism 110 is controlled, at block 430, theon-board kill switch notifies the parachute deployment mechanism 130 todeploy the parachute 125.

In some embodiments, the tilt includes an attitude of the drone 100,e.g., which is an orientation of the drone 100. The attitude of thedrone 100 can be obtained using one or more sensors onboard the drone100.

Referring back to block 405, if the error is a sudden decrease in thealtitude, at decision block 430, the error detection circuit 120determines whether the speed at which the drone 100 is descendingexceeds a third threshold, e.g., 5 m/s. If the descend speed of thedrone 100 does not exceed the third threshold, the process 400 returns.On the other hand, if the descend speed of the drone exceeds the thirdthreshold, the process 400 proceeds to block 420 and determines whetherto deploy the parachute 125 or not as described above.

Referring back to block 405, if the error is of other types, at decisionblock 435, the error detection circuit 120 determines if the error is ofany of the specified types for which the parachute 125 is to beautomatically deployed, e.g., navigation loss, communication loss, powerloss, impact, gyro error, motor control, sudden drop, inversion, fire,video loss, heartbeat loss, geo fence breach, or lack of electricalsignal from error detection circuit 120. If the error is not of thespecified types for which the parachute 125 is to be automaticallydeployed, the process 400 returns. On the other hand, if the error is ofthe specified types for which the parachute 125 is to be automaticallydeployed, the process 400 proceeds to block 420 and determines whetherto deploy the parachute 125 or not as described above.

Communications Methods

The PDS 190 has the capability to remotely and manually trigger theparachute 125 and shut down the drone 100. In some embodiments, the PDS190 is configured to:

-   -   have the communications work within a reasonable range, e.g.,        the drone 100 is within sight of the operator; and    -   transmit back its state and confirm each input by the user.

In some embodiments, the radio transceivers used include a radiotransceiver that provides a very convenient way of achieving full duplexwireless communication between the drone and a base unit operated by theoperator. An example of the radio transceiver includes XBee-PRO 900HP(S3B). Although the XBees are technically half-duplex, they containinternal buffers that make them function as full duplex devices.

The radio transceiver can be made flexible in terms of its strength anddata rate, through simple configurations. Once configured correctly, theradio transceiver simply receives, in the form of serial communications,signals from any radio source coming from the same type of radiotransceiver, with the same type of configuration.

After the setup, on the on-board processor of the drone, one radiotransceiver is simply mounted on a wireless SD shield, e.g., an ArduinoWireless SD Shield, while the other is connected through an USB adapterto a remote PC. The Wireless SD shield, shown in FIG. 5A, provides awireless communication platform between the radio transceiver and theon-board computer (Arduino Uno) through an internal serial link. FIG. 5Ashows an example of a communications subsystem having a wireless SDshield, consistent with various embodiments. FIG. 5B shows an example ofa communications subsystem having an XBee radio transceiver, consistentwith various embodiments. The wireless shield also offers a micro SDcard slot, which allows the possibility of an extension involving anon-board logging of data. For example, sensor readings can be written tothe on-board data logging module provided by the SD Shield at a higherfrequency than it would transmit back to the ground station, for lateranalysis purposes.

The long-range radio transceivers operate at 9600 baud, although this iseasily adjustable to suit higher data rate demands. In some embodiments,the radio transceiver module has transmission power of 250 MW. Its lineof sight transmission range is very flexible—depending on the antennasize. With an optimal antenna, the radio transceiver can communicate atdistances up to 45 km (Line of Sight). However, under more modestantenna sizes, the radio transceiver can communicate at specifieddistances, e.g., up to 14 km, if they are within light of sight towardseach other. Under indoor conditions, however, the blockage may reducethat distance down to a specified maximum communicating distance, e.g.,600 m. Nevertheless, this can usually be easily avoided by having alarge antenna on the ground end, located further from the ground such asthe top of a building.

The radio transceiver communicates at an adjustable frequency, e.g.,between 902 MHz to 928 MHz—so that it can be configured to avoid thecommon frequency for communications, e.g., 915 MHz. The bandwidth can beconfigured to be sufficiently small to avoid any interference. The datarate can also be configured to between a specified range, e.g., 10 Kbpsor 200 Kbps.

The radio transceiver is a very economical way of achieving wirelesscommunication, as it is greatly supported by the Arduino community, andit communicates in the form of Universal AsynchronousReceiver/Transmitter (UART) serial communications—meaning that minimaldecoding and encoding needs to be done. This also allows the softwaredesign on the part of communications to be simple—it is simply a matterto handling serial data and serial transmission/reception, for which theArduino already has in-built libraries and functionality.

In some embodiments, the PDS 190 also includes a graphical userinterface (GUI) and a set of tele commands for automatic failuredetection by the PDS 190. On a remote PC, the user can choose tocontinuously receive system state data, such as the roll, pitch, and yawof the drone, or disable this option completely. The user can alsoverify and toggle the mode of the automatic detection failure—whetherautomatic deployment and shut off is enabled or not. In either case, theuser may always have access to manually trigger the parachute deploymentand motor shut off—through the press of a single button, e.g., “kill”switch, e.g., in case of emergency. The software is designed to be veryscalable; the list of commands can be expanded very easily, so thatextra functionality and commands can be built into the system in astraightforward manner if future scenarios require so.

An example list of commands of the automatic failure detection portionof the PDS 190 include:

-   -   h: help command—displays the following list of commands    -   c: check mode (automatic or manual, and is it deployed?)    -   a: set as automatic mode (shut off will be automatically        triggered)    -   m: set as manual mode (shut off will not be automatically        triggered)    -   t: toggle mode (between automatic and manual mode)    -   d: deploy parachute and shut off motor (if in manual        mode—non-emergency)    -   s: screen data display toggle (whether or not to display IMU        information)    -   z: emergency deploy and motor shut off (for immediate emergency        use)

Power

In some embodiments, the PDS 190 is completely self-powered, that is, itcan have an independent power supply and does not share the power supplyof the drone 100. This can be essential in keeping the whole parachutedeployment method as modular as possible. A separate power supply to thePDS 190 would ensure maximum reliability.

In some embodiments, the power subsystem of the PDS 190 is configuredto:

-   -   1. sustain charge for at least a specified amount of time, e.g.,        one return flight, which can be 1 hour;    -   2. power the servo that controls the parachute; and    -   3. occupy minimal space.

For example, if the microcontroller used is the ATmega328, themicrocontroller uses around 10 mA of current when it is operating. Thebuilt in efficiency η≈0.9 of the on-board voltage regulator is alreadyincluded in the 10 mA of current draw. Since the Arduino is completelypowered on, it will use approximately 36 mAh/h. If the radio transceiveris XBee (900HP), for example, it uses 230 mA of current to transmit and45 mA to receive. The transmitter may be activated every 10 seconds andtakes at most 0.1 seconds to transmit all the data. This translates toaround 0.032 mAh per transmission. Receiving is always active andtherefore uses 162 mAh/h. Combining the two power requirements, thepower module therefore uses around 170 mAh/h. Some example powercalculations of the power subsystem are summarized in table 2.

In some embodiments, since the servo is only powered for less than asecond, it may draw less than 40 mA of current and therefore, the powerrequirements are negligible. The same can be assumed for the logic levelmultiplexers used to cut-off the signal to the motor controllers.

TABLE 2 Power Calculations Current Time on/hour Power Req./h ATmega32810 mAh 3600 seconds 36 mAh XBee 900 HP TX 230 mAh   36 seconds ~8 mAhXBee 900 HP RX 45 mAh 3600 seconds 162 mAh  Total ≈206 mAh 

In some embodiments, any battery that has a capacity of around 200 mAhwould power the entire safety delivery system for roughly an hour. Insome embodiments, the chosen battery size is 2500 mAh. While the sizeand weight of the 2500 mAh Adafruit batteries are nearly double the 1200mAh batteries, the factor of safety and convenience is worth carryingthe extra volume and weight, at least for Mark I of the system. Thevolume is not much of an issue anyway because it can easily fit in theArduino plastic box that came with the components. The examplespecifications of the battery are:

-   -   The output ranges from 4.2V when completely charged to 3.7V.    -   2500 mAh    -   Included protection circuitry keeps the battery voltage from        going too high (over-charging) or low (over-use) which means        that the battery will cut-out when completely dead at 3.0V.    -   Max 1200 mA charge rate (ideally 500 mA).    -   Genuine 2-pin JST-PH connector.    -   Weight=52 g    -   Size=51 mm×65 mm×8 mm

The circuit also uses a voltage regulator to power the Arduino and othercomponents. Since all other components (parachute servo, XBee, etc.)powered directly from the Arduino Uno board then there would be no needfor an external regulator since the Arduino Uno already has an on-boardregulator. It was, however, included such that there would be a voltageregulator for Mark II, where the ATmega328 chip would be removed fromthe Arduino and soldered directly onto a custom-made PCB. The voltageregulator would then power the Arduino itself and all peripheralcomponents. In Mark II, it would also be recommended to switch to aPololu regulator even though it is not entirely necessary, to regulatevoltage both ways (buck boost). Because the batteries supply 3.7-4Vduring nominal operation, then there would only be a boost required (totake it up to 5V). Having only one switching voltage regulator in MarkII would then maximize the power efficiency (η≈0.9 instead of η≈0.81).The example specifications are:

-   -   2 A internal switch (2.5 A peak limiting) means one can get 500        mA+ from a 3.7V LiPoly/LiIon battery.    -   Low battery indicator LED lights up red when the voltage dips        below 3.2V.    -   90%+ operating efficiency in most cases.    -   Weight=4 g    -   Size=22 mm×37 mm×2 mm

Alternatively, the whole PDS 190 could be powered by a single 9V batterywhich depending on the manufacturer and the chemicals used gives around500 mAh. That is around 2.5 hours of use. The advantage of this is thatthe boost converter from the batteries can be excluded and the onboardregulator on the Arduino Uno board can be used. The 9V battery may beplugged into the “VIN” terminal on the Uno board.

The battery charger can supply a steady current to the batteries. Theexample specifications of the battery charger are:

-   -   USB or DC power—5 to 12V input    -   Charges one single-cell 3.7/4.2 v batteries    -   Three indicator LEDs—green for power, orange for charging and        red for error    -   Charging LED will blink when the battery is full

Note that the power to other circuitry like the multiplexers is minimal.

FIG. 6A shows an example of a 2500 mAh battery consistent with variousembodiments. FIG. 6B shows an example of a voltage regulator, consistentwith various embodiments. FIG. 6C shows an example of a battery charger,consistent with various embodiments.

In some embodiments, the power subsystem of the PDS 190 could beameliorated in multiple ways:

-   -   1. A smaller buck boost from Pololu could be used. The Pololu        voltage regulators are smaller but do not compromise on current,        delivering up to 1 A.    -   2. If no custom-PCB is made where the Uno dev board is removed,        the whole circuitry could be powered from the regulator on the        dev board itself, eliminating the need for an external voltage        regulator.    -   3. A smaller battery could be used to minimize the size. It is        unlikely that a drone will be flying 12.5 hours every day. This        would also minimize on weight.    -   4. The ADC on the Arduino could be used to sense and report on        battery level.

Parachute

In some embodiments, the parachute 125 is chosen such that the parachute125 supports a specified minimum weight, e.g., 4 kg, while keeping thedescent rate to a specified maximum, e.g., approximately 4 m/s. Thisrequirement can be essential to ensure the safety of humans uponcollision; by having a low descent rate the impact upon collision isreduced. This would mean that if the drone is to collide with anexternal object then, then the damage is minimized for both the droneand the object.

In some embodiments, the parachute 125 is configured to:

-   -   1. support a specified weight, e.g., 4 kg.    -   2. provide a specified maximum descent rate, e.g., approximately        4 m/s.    -   3. be compact, so that it doesn't take up too much space on the        drone.    -   4. not weigh more than a specified amount, so that it doesn't        contribute extra mass to the drone.

In some embodiments, the size of the parachute 125 is determined as afunction of the maximum weight of the drone on which the parachute 125is going to be installed as well as the maximum desired descent rate. Insome embodiments, parachutes with 48 and 60 inch diameter will support a4 kg drone with a maximum desired descend at nearly 5 and 4 m/srespectively.

In some embodiments, the parachute 125 illustrated in the figures can beone of the standard parachutes available in the market. While choosingthe actual parachute, it is essential to note the space available, theweight it contributes to the drone and the deployment method. In someembodiments, a gas based deployment system can be used to deploy theparachute 125, where gases like CO2 are used for quickly ejecting theparachute 125. However, the gas canisters may have to be continuallyreplaced after every deployment.

FIG. 7 shows an example of a parachute 125 that can be employed in thePDS 190, consistent with various embodiments. In some embodiments,spring loaded parachutes can be installed on the drones. Thespring-loaded parachutes are reusable and can be deployed by poweringthe servo motor to release the highly compressed spring inside acanister which ejects the chute for deployment.

FIG. 8 shows examples of different types of parachutes that can beinstalled on the drone, consistent with various embodiments. The FIG. 8illustrates a type A parachute (left) and a type B parachute (right). Ascan be seen, there is a large hole in the middle of the type A parachutewhile type B is fully covered. In some embodiments, since the type B thechute is fully covered it would offer greater drag, resulting in a lowerdescending rate.

If the drones are larger, e.g., heavier than 4 kgs, a parachute largerthan 58″ may be installed. For example, a 192″ parachute can support a20 kg weight and offer a descent rate less than 3 m/s.

Motor Cut-Off

In order for the drone to safely land in the event of failure of thedrone, the motors need to shut-off when the parachute 125 is deployed.In some embodiments, the motors are shut off nearly instantaneously whencommanded otherwise the parachute 125 may not deploy properly or gettangled in rotors.

The power can be shut-off from the battery to the rest of the drone.However, the switch that needs to be fitted would need to be capable ofhandling the maximum current that can be supplied by the battery. Forexample, each motor can draw up to 38 A when fully powered and on aquadcopter drone this can mean a current draw of up to 152 A for themotors alone. If the battery is rated 30 C at 8000 mAh, this can meanthat the maximum current it can provide is 240 A, which is quite a largecurrent and would require relays that are bulky and heavy (householdcircuitry).

Another alternative is to connect a large number of power-MOSFETs inparallel and control them all as the same switch. This can again bequite a large circuit and would also require the knowhow of thermallyregulating the components.

Another alternative is to use a mechanical switch, e.g., a spring loadedmechanical switch, that would disconnect the drone circuitry from thebattery. However, it would involve mechanical components that could beeasily destroyed or damaged upon failure and testing. It would also besusceptible to in-flight vibrations that could prematurely disconnect aresult of the vibrations.

Another alternative is to block the throttle signal from the flightcontroller to the motors of the drone, and substitute it with a zerothrottle signal from the Arduino causing the motors to brake. The PDS190 circuit multiplexers enable the signal from the flight controller tothe ESC to be blocked off and a new zero throttle signal generated bythe Arduino is sent to the ESC instead. Multiplexers can be used inorder to be able to switch the signals from the flight controller outputto the Arduino signal. In some embodiments, the signal to the motordrivers can be ground. With this, there can be some delay, e.g., 3 sec,in stopping the motors. This can mean that the motor controllerregisters this as ‘signal lost’ rather than a signal meaning “0”revolutions per minute (RPM). In order to find out the pulse-widthmodulation (PWM) frequency and duty cycle, the “0” RPM signal can beanalyzed on an oscilloscope. The signal can be: 400 Hz, 3.3V_(pp), and44% duty cycle.

If any of these requirements are not met (with the exception of the dutycycle) then the motor controller will not acknowledge the signal andcontinue its operation for a specified time, e.g., 3 seconds. The dutycycle is 44% at rest, around 46% when it starts idling and can go up to100% for full power.

Analogue multiplexers, e.g., 4052 4-channel from Jaycar, can be usedsince they are bidirectional and can allow for any voltage level. Themultiplexers can come in several packages (plastic, ceramic, micro, chipcarrier). Since there are only 2 per input, 2 chips may be needed on thequadcopter. The multiplexers can be controlled by 2 digital inputs (Aand B).

FIG. 9A shows a logic table for the input states of the analoguemultiplexers, consistent with various embodiments. FIG. 9B shows a pindiagram for the analogue multiplexers, consistent with variousembodiments. The FIGS. 9A and 9B illustrate a logic table and pinassignments for the 4052 multiplexer. Since only two inputs need to beused (0X, 1X and 0Y, 1Y), B can be grounded and A can be controlled fromthe Arduino; minimizing the inputs required. Therefore, it would be assimple as setting a pin high. One of the inputs (0X) is connected to theoutput of the flight controller and the other input (1X) is coming infrom the Arudino (the fake signal replicating 0 RPM conditions). Theoutput (X) is connected to the motor controllers.

It should be noted that when multiple motor controllers are connected,the power buses are common going in and out of the PDS 190 (all blackand red voltages are at the same level to and from the PDS 190). Groundshould also be common with the PDS 190. In some embodiments, the ArduinoUno is capable of generating PWMs through its PWM function. On mostpins, it is 490 Hz and 980 Hz on pin 5 and 6. In some embodiments, thirdparty libraries can be used to set interrupts precisely when they needto fire. The signal therefore has to be 1100 microseconds high and then1400 microseconds low.

With the following setup, the motors almost immediately stop rotating.FIG. 10 shows a schematic for the circuit for shutting off the motorsinstantly, consistent with various embodiments. FIG. 10 also shows thepin assignments for the PDS 190. Note that not all wires are shown.

Following are some other methods under which the lift mechanism 110 canbe disabled. For example, as illustrated in FIG. 11, the cut-off circuit155 can break the electrical connection between the auto pilot system(flight controller 115) and the ESC. When the power supply to the autopilot system is disconnected, the lift mechanism 110 will be disabled.In another example, as illustrated in FIG. 12, the cut-off circuit 155can break the electrical connection between the ESC and the motors ofthe lift mechanism 110. In another example, as illustrated in FIG. 13,the cut-off circuit 155 can cut-off the power supply to the motors ofthe lift mechanism 110. In another example, the cut-off circuit 155 canfacilitate physically cutting the electrical connection to stop signalto the motors. The PDS 190 can have a severing mechanism to physicallycut-off the electrical connection. In another example, the cut-offcircuit 155 can facilitate physically braking the motors, e.g., bysending a signal to activate the brake pads of the motors. In anotherexample, the cut-off circuit 155 can facilitate ejecting of thepropellers of the lift mechanism. The cut-off circuit 155 can beimplemented in various ways for each of the above methods.

Rotor Protection Shroud (RPS)

To further minimize the damage to the rotors and/or surroundings uponlanding, the rotor blades of the drone 100 may have to be protected withshrouding. The embodiments provide a scalable, minimalist design for theshrouding that experiences little vibrations. The shrouding can be builtusing carbon fiber material.

In some embodiments, a rotor shroud offers sufficient protection againstthe tips of the blades should it bump into an object or as it comes into land after the deployment of the parachute 125. In some embodiments,the rotor shroud is configured to be:

-   -   1. lightweight, e.g., weight not exceeding a specified amount,        so that it doesn't add significant additional weight to the        drone;    -   2. complete shielding of the rotor, so that the blades don't        come into contact with object upon collision; and    -   3. durable upon impact, so that the structure doesn't damage the        drone or cause more harm to a person the drone collided into.

The following paragraphs describe a RPS designed for a quadcopter of 4kg with 11 inch blades (279.4 mm diameter), which can also be upgradedto the hexa-copter with 15-inch blades. However, the RPS designs can beextended to various types of drones. The collision analysis can be madeassuming the worst-case scenario where the drone is free-falling;therefore a force of 39.24N was applied to testing the deflection of thestructure. Also, the RPS can be made according to various designs, eachhaving their own characteristics.

FIG. 14 shows a first design for the RPS, consistent with variousembodiments. The first design can be based on stock rotor protectionshrouds, which are seen on hobby quad-copters. The model's 300 mmdiameter circular wall visually offers complete shielding. The shroudcan be of VeroWhite material, which has similar properties toAcrylonitrile butadiene styrene (ABS).

FIG. 15A shows a result of the stress analysis of the RPS designed basedon the first design of FIG. 14, consistent with various embodiments.FIG. 15B shows a result of the deflection analysis of the RPS designedbased on the first design of FIG. 14, consistent with variousembodiments. The result shows over 39 mm of predicted deflection, whilethe maximum stress experienced by the structure is lower than the yieldstrength (it will not break), there is only a 10.3 mm allowance gapbetween the blade and the shroud at any given time. This means that uponcollision the shroud can push into the blade, damaging and possiblybreaking the blade. Such a disaster poses a great threat if it was tocollide into a human, as the blade broken while spinning at highvelocity can act unpredictably and can severely harm the person.Strengthening the structure to reduce deflection is not an option,simply because the model currently weighs 350 g per unit, therefore fora quadcopter the total rotor protection shroud unit will weight over 1.2kg. Such a weight may not be ideal for a drone, as it compromises theflying performance.

FIG. 16 shows a second design for the RPS, consistent with variousembodiments. The second design addresses the problems faced in the firstdesign. The change includes transforming the right-angled struts intoelliptical support beams, as curved supporting features shown in themodel offer greater structural strength during tension and compressionwhile reducing material needed. The second issue of weight is alsoaddressed by making the structure as “empty” as possible withoutcompromising the structural strength, which facilitated in increasingthe gap between the blade and the guard to allow for greater impacts.

FIGS. 17A and 17B show the results of finite element analysis (FEA)conducted on the second design, consistent with various embodiments.FIG. 13A shows the result of stress analysis of the model and FIG. 13Bshows the result of deflection analysis of the model. From the resultsacquired, it is evident that maximum stress experienced by thisstructure is lower than the RPS of the first design and well below itsbreaking point. Also, the maximum deflection was found to be 13.34 mm,while the allowable displacement is over 15 mm, which means that evenupon impact our structure stays intact and continues to provideshielding from the blades. The mass of structure was found to be 145 g,which is less than half the first design, hence a quadcopter would carryan additional weight of 580 g.

FIG. 18 shows a 3D printed model of the RPS based pm the second design,consistent with various embodiments. The 3D printed model is made usingVeroWhite.

FIG. 19 shows a third design for the RPS, consistent with variousembodiments. In some embodiments, the RPS based on the third design ismade using carbon fiber. While carbon fiber is more dense compared toVeroWhite/ABS, it has an excellent weight to strength ratio. This canmean that the material used for the shroud can be further reduced whileincreasing the structure's strength. In some embodiments, the thirddesign is similar to the second design, however rather than supportingstruts it has a tubular network as shown in the FIG. 19.

FIGS. 20A and 20B show the results of the FEA conducted on the thirddesign, consistent with various embodiments. FIG. 20A shows the resultof stress analysis of the model, and FIG. 20B shows the result ofdeflection analysis of the model. From the results, it can be concludedthat the structure can easily support the weight of the drone, andsafely shield the blades from external objects. In some embodiments, themass of this structure is 77 g, which would mean a saving of 310 gcompared to previous designs for excellent safety system.

In some embodiments, carbon fiber tubes which are of straight shapes,e.g., as in the first design, instead of an elliptical fashion as in thethird design can also be used. While the mass of the first design isdeemed to be heavy, making the carbon fiber model hollow can solve theproblem.

The following paragraphs describe some example features of the drone andthe base unit (e.g., remote controller operated by a remote user tonavigate and/or kill the drone) that can be used with the disclosedembodiments.

Drone Unit

-   -   Support for hexacopter (2 sets of 3×6 pins)    -   IMU auto deploy algorithm, which deploys the parachute 125        automatically when a failure of the drone is detected, e.g., as        described at least with reference to automatic failure detection        above    -   Recalibrate min height from launch height    -   Reset pin    -   Wireless communications with Xbee 900HP:        -   Manual trigger        -   Auto deploy on/off    -   ESC 0 RPM signal reproduction: 44% duty cycle at 400 Hz    -   78.7×39.4 mm    -   Pins for chute servo    -   4 hour battery life (untested—estimate)    -   Removable microprocessor    -   Servo cable mounts (0.1″ servo cables)    -   Status LED

NOTE: Powered by 3.7V Li-ion from Adafruit. This can be the 6600 mAhbattery (blue cylinders) with no protection circuit as the current drawfrom the Mars 120 parachute is too large for the batteries withprotection circuits (white with yellow tape on top).

Base Unit

In some embodiments, the base unit 195 can be configured to have thefollowing:

-   -   Deploy switch, e.g., push-button for deployment—to send a signal        to an onboard “kill” switch on the drone 100 that, when        activated, causes the drone 100 to deploy the parachute 125    -   Auto deployment switch, e.g., DIP switch for on/off auto        deployment—to enable or disable auto deployment of the parachute        125 on the drone 100 in response to a failure of the drone 100    -   Communications system, e.g., Xbee 900HP,—to send and receive        instructions from the drone 100.    -   I/O switch on the side    -   Arming flip switch (guard optional)—to enable or disable manual        deployment of the parachute 125 from the base unit 195    -   Battery, e.g., 3.7V Li-ion rechargeable battery

In some embodiments, the deploy switch sends the signal to the “kill”switch on the drone 100 if the arming switch is enabled and when thedeploy switch is activated by the remote operator 105.

Following are some example instructions for installing the PDS 190 onthe drone:

-   -   Plug the ESC cables from the flight controller into the IN ports        on the unit. The direction is labelled on the PCB (SIG is the        topmost pin).    -   Plug the motor ESC cables into the OUT ports on the unit.    -   Connect the 3.7V battery.    -   Reset the unit. So that the green LED is solid green and not        flashing green.    -   Proceed to turn on the drone normally.

The LED will blink green when the parachute 125 has been deployed. Usethe Reset button to switch it back into normal mode. The servo on theparachute 125 will also reset to its closed position.

Following are some example instructions for navigating the drone anddeploying the parachute 125:

Installation and Use

-   -   1. On the drone unit, plug the ESC cables from the flight        controller into the IN ports on the unit. The direction is        labelled on the PCB (SIG is the topmost pin).    -   2. Plug the motor ESC cables into the OUT ports on the unit.    -   3. Connect the 3.7V battery.    -   4. Reset the unit. This is important! So that the green LED is        solid green and not flashing green.    -   5. Proceed to turn on the drone normally.    -   6. Continue on the handheld unit: Power on the unit and observe        red LED. If this is solid, then a connection has been        established. This LED will turn off when the unit has lost        connection.    -   7. Green switch can be used to turn on/off the auto-deploy. It        is recommended to have this off as the vibrations on the IMU on        the drone can be very excessive (+/−5 m/ŝ2) and trigger when        spinning at take-off RPMs.    -   8. To deploy: flip the arming switch to the ON position, then        press the red pushbutton.    -   9. The green LED on the drone unit should start to flash green,        indicating the parachute 125 has been deployed. The red LED on        the handheld unit should start to flash.    -   10. To reset: Turn OFF the handheld unit, then press the RESET        pushbutton switch on the drone unit. The green LED should now be        solid again. This will also move the Mars Parachute servo to the        CLOSED position.    -   11. Turn the handheld unit back ON.

In summary, the LED on the drone unit:

-   -   GREEN: Solid=ON. Off=OFF. Flashing=DEPLOYED.

Handheld Unit:

-   -   GREEN: Solid=ON. Off=OFF.    -   RED: Solid=Link established. Off=Link lost. Flashing=DEPLOYED.    -   YELLOW: Solid=AUTO ON. Off=AUTO OFF.

XBees

Any set of matching XBees can be used. The recommended XBees (currentlyin use) are:

-   -   XBee-PRO 900HP (S3B)—XBP9B-DPST-001—Point2Multipoint, 900 MHz,        250 mW, RPSMA, 10 Kbps (North America)

There are pairs of XBees matched to each other (e.g., 1A and 1B, 2A and2B). They will only be able to send and receive messages to each other(done using addressing). On top of this, all communications areencrypted.

Encryption

The XBees are encrypted using AES. The key is:

-   -   0F89EEECCFBF1E67555AE88D8171E2A2

Range Test

The Xbee range test carried out here is for the old 200 Kpbs Xbee(XBP9B-DMST-012). The new Xbees (10 Kbps) offer a greater theoreticalrange (yet untested) and come with 900 MHz dipole antennas (larger butoffer better range).

-   -   XBee-PRO 900HP (S3B) DigiMesh, 905/920 MHz, 250 mW, RPSMA        Antenna, 200 Kbps (Brazil)

The 900HP set are used because they are more powerful than the Series 1and Series 2 Pro XBees. The LOS range was tested and around 335 mpackets were starting to be lost (see graph below—starting point is 0 mto 335 m). 2.4 GHz antennas were used for this test as no 900 MHz oneswere available.

FIG. 21 is a flow diagram of a process for a motorized descent of thedrone with the parachute ejected, consistent with various embodiments.The process 2100 may be implemented using the drone 100 of FIG. 1. Thedrone 100 may be steered to a particular landing location, e.g., a safelanding location, with the parachute ejected. In some embodiments, theparticular landing location details, e.g., GPS co-ordinates, areprovided to the drone 100 by the remote operator 105 or from a groundcontrol station. In some embodiments, the flight controller 115 or thePDS 190 determines the safe landing location based on one or moreparameters, e.g., any humans, or objects of a specified size within aspecified area around the drone 100, density of humans or objects withinthe specified area, an area of land or water within the specified area.As described at least with respect to FIGS. 1A and 2 above, the drone100 can be steered to the particular landing location by steering theparachute 125. In some embodiments, the lift mechanism 110, e.g., one ormore of the motors of the drone 100, can be used to steer the drone 100to the particular landing location with the parachute 125 ejected, e.g.,in order to get a better control in steering the drone 100. The drone100 can be steered using the motors in addition to or alternative tosteering the parachute 125. In some embodiments, if the motors are notworking, e.g., the power supply to the motors is cut-off, the drone 100is steered by steering the parachute 125 and not the motors. Thefollowing paragraphs describe steering the drone 100 using the liftmechanism 110 with the parachute 125 ejected.

At block 2105, the parachute deployment mechanism 130 deploys theparachute 125. The parachute 125 can be deployed automatically inresponse to occurrence of a trigger event. In some embodiments, thetrigger event is generated upon occurrence of an error, e.g., collisionwith another object, presence of another object within a specifiedproximity, speed and/or altitude exceeds a specified value, e.g., asdescribed at least with reference to FIGS. 1A, 2 and 4. The parachute125 can also be deployed manually, e.g., by the remote operator 105 atthe base unit 195. In some embodiments, the remote operator 105 canactivate the kill switch 193 on the drone 100 using the base unit 195,and the kill switch 193 can control the lift mechanism 110, e.g., stopsome or all of the motors of the lift mechanism 110, and notify theparachute deployment mechanism 130 to deploy the parachute 125.

The parachute deployment mechanism 130 can be configured to inflate theparachute 125 instantaneously and/or rapidly upon deployment. In someembodiments, rapid inflation of the parachute 125 may be necessary toopen the parachute 125 at lower altitudes, e.g., altitude below aspecified threshold such as 15 meters, 12 meters or 10 meters, andtherefore, avoid the drone 100 from crash landing, which can causedamage to the drone 100. The parachute deployment mechanism 130 canimplement the rapid inflation of the parachute 125 using various means,e.g., ballistic or mechanical. For example, the parachute deploymentmechanism 130 can use air or CO₂ gas to rapidly inflate the parachute125. In another example, the parachute deployment mechanism 130 can usea spring loaded mechanism to rapidly inflate the parachute. In yetanother example, the parachute deployment mechanism 130 can usepyrotechnics to rapidly inflate the parachute 125. In some embodiments,a projecting weight is connected to the parachute 125 to force open theparachute 125 more rapidly. The weight can be fired outward, e.g., in asemi-circular or circular pattern, and at a particular angle, e.g., 90degrees off of the parachute 125, to cause the parachute 125 to deployfully and instantaneously. The weight can be connected to the center ofthe parachute 125. When the parachute 125 is deployed, the weight ispulled down, due to gravity, causing the parachute 125 to immediatelyinflate/open up by its downward motion in the air.

In some embodiments, an umbrella-type mechanical mechanism is used toforce open the parachute. For example, the umbrella type mechanism caninclude a folding canopy supported by ribs, which is mounted on a pole.In some embodiments, the parachute deployment mechanism 130 can blowopen the parachute 125 with a rapid ejection of gas. For example, a gascanister filled with compressed gas, e.g., at an appropriate pressure,(or when the chemical is activated to create a controlled chemicalexplosion which generates gas) or a gunpowder type explosion, canrelease the gas at a rapid pressure resulting in instantaneous inflationof the parachute 125. In some embodiments, a ducted fan which generatesairflow into the parachute 125 to cause the parachute 125 to rapidlyinflate can be used. In some embodiments, vented or tubular inflatablesupports can be included within the parachute 125 which can be filledwith air to cause the parachute to rapidly inflate, e.g., like aninflatable air dancing man. In another example, a power activated pistonin which a piston is released when it is supplied with electrical powerreleases a significant amount of energy, which can be used to eject andinflate the parachute 125 rapidly. The parachute 125 can be inflatedwithin a specified time, e.g., milliseconds, which can significantlyincrease the chances of safe landing, especially when at low altitudes.Further, the parachute deployment mechanism 130 can ensure thatparachute is deployed far beyond the propel spinning radius. Multipleparachutes can be installed on the drone 100 to get more drag and/orredundancy.

At block 2110, the parachute deployment mechanism 130 determines if theparachute 125 is inflated completely. If the parachute 125 is notinflated completely, the flight controller 115 waits until the parachute125 is inflated completely. The parachute deployment mechanism 130 cannotify the flight controller 115 after the parachute 125 has inflatedcompletely, which in some embodiments, is when the drone 100 is readyfor the flight controller 115 to regain control for performing acontrolled landing. If the parachute 125 is inflated completely, atblock 2115, the flight controller 115 activates the lift mechanism 110,e.g., powers on one or more of the motors of the drone 100. In someembodiments, the drone 100 experiences a sudden lift, a decrease in thedescend speed, or can continue to fly at a specified altitude inresponse to an activation of the lift mechanism 110, all of which candelay the deployment of the parachute 125 or keep the parachute 125 frominflating completely. Accordingly, the flight controller 115 may notactivate the lift mechanism 110 until the parachute 125 is inflatedcompletely in order to avoid any further delay in the parachute 125being deployed or inflated completely. The lift mechanism 110 can beactivated automatically, e.g., based on a detection of the parachute 125being deployed, or manually, e.g., by the remote operator 105 from thebase unit 195. Further, the flight controller 115 can activate the liftmechanism 110 in a controlled manner, e.g., turning on and/or adjustingthe speed of one or more motors in a particular pattern or sequence, toassist in steering the drone 100 during the descent. In someembodiments, if the lift mechanism 110 is permanently disabled, e.g.,not functional, the flight controller 115 may not activate the liftmechanism 110. If the lift mechanism 110 is partially disabled, e.g.,some of the motors are functional and some are not functional, theflight controller 115 may activate the portion of the lift mechanism 110that is functional.

At block 2120, the flight controller 115 manages steering the drone 100to the particular landing location using the lift mechanism 110. Thedrone 100 can be steered using the lift mechanism 110 and/or theparachute 125. In an event where the lift mechanism 110 is partiallydisabled, the flight controller 115 may adjust the load of the drone 100on the portion of the lift mechanism 110 that is functional, e.g., onone or motors that is functional, and steer the drone 100 using thefunctional portion of the lift mechanism 110.

The drone 100 can be steered automatically (e.g., autonomously), ormanually by the remote operator 105 using the base unit 195. In someembodiments, the flight controller 115 and/or another control unit,e.g., the PDS 190, can steer the drone 100 automatically/autonomously,e.g., using integrated sensors, such as video feed, sonar, radar, LIDAR,computer vision, infra-red, NIR, thermal, sonic, of the drone 100,facilitates in avoiding obstacles and landing the drone 100 at thesafest available location or a specified location. For example, theflight controller 115 can communicate with the video system 165 tomonitor the environment around the drone 100 and the PDS 190 canautomatically send commands to control the lift mechanism 110, e.g.,aelerons and propellers, (which was shut off when the parachute 125ejected) in order to control the drone 100 and land the drone 100 at thesafest available location in the event of the failure of the drone 100.In another example, the drone 100 can be steered manually by the remoteoperator 105 from the base unit 195, e.g., using a live video feed fromthe drone 100, GPS coordinates, or directly if the drone 100 is in aline of sight of the remote operator 105. This can be to reduce theprobability of impact with a person on the ground or landing in anunsafe location such as a busy road or on a private property. Both ofthe steering methods, e.g., steering using the parachute and steeringusing the lift mechanism, can be performed autonomously by the drone 100or manually by the remote operator 105. In some embodiments, the remoteoperator 105 can also override the autonomous steering of the drone 100.

At block 2125, the flight controller 115 lands the drone 100 at theparticular landing location. At block 2130, after the drone 100 haslanded at the particular landing location, the communication system 150can send an audio notification, a video notification, or an audio-visualnotification to the remote operator 105 at the base unit 195 indicatingthat the drone 100 has landed. The notification can also include variousinformation, e.g., co-ordinates of the particular landing location, anda time at which the drone 100 landed.

The above described controlled steering of the drone 100 using the liftmechanism 110 can be implemented in a wide variety of drones, e.g.,fixed-wing drones, helicopter rotors and blades based drones, or hybriddrones. For example, in a fixed-wing drone, the lift mechanism 110 canhave ailerons using which the descent can be controlled. In rotors andblades based drones, some or all of the motors of the lift mechanism 110may be activated to steer the drone 100. For example, in a quadcopterall of the motors may be activated and used to steer the drone 100 andin a hexacopter only four of the six motors may be used. In anotherexample, in a hybrid drone in which the lift mechanism 110 has a singletraditional propeller and ailerons, the drone 100 can be steered usingthis propeller and the ailerons during a motorized descent. The motoroperations on a quadcopter can be different to those on a hexacopter,which will be different to those on a hybrid drone having one or moremotors and ailerons, and the above steering mechanism can be implementedin any of these drones. The flight controller 115 can be programmed toidentify the type of the drone 100 and implement the steering mechanismaccordingly.

While the operations described above with reference to the process 2100can be performed automatically by the drone 100 or manually by theremote operator 105, in some embodiments, at least some of theautonomous steering operations can be manually overridden by the remoteoperator 105. For example, the drone 100 may be programmed to land in afirst landing location. However, the remote operator 105 can command thedrone 100, e.g., during the descent, to land in a second landinglocation.

FIG. 22 is a flow diagram of a process 2200 for activating audio-visualindicators on a descending drone 100, consistent with variousembodiments. The process 2200 may be implemented in the drone 100 ofFIG. 1. At block 2205, the communication system 150 detects that theparachute 125 is deployed. In some embodiments, the communication system150 obtains the deployment information of the parachute 125 from theparachute deployment mechanism 130. At block 2210, the communicationsystem 150 confirms that the drone 100 is descending. For example, thecommunication system 150 can confirm that the drone 100 is descendingbased on the altitude of the drone 100 that can be determined using oneor more sensors. At block 2215, the communication system 150 activatesthe on-board indicator on the drone 100 to indicate to people or anotheraircraft that the drone 100 is descending and about to land. In someembodiments, the indicator is activated to notify the landing of thedrone 100 to the people in the vicinity of the landing area so thatpeople can be cautious and can move or move other objects from thatlocation in order to avoid any impact with the drone 100. The on-boardindicator can be an audio indicator, a visual indicator or anaudio-visual indicator. In some embodiments, the audio indicator can bean audio signal, e.g., a siren, that is loud enough to be heard by thepeople in the vicinity. In some embodiments, the visual indicator can beone or more lights. In some embodiments, the lights can be ofhigh-intensity and also be configured to flash to get the attention ofthe people. The indicators can be used for reducing the probability ofimpact of the drone 100 with a person or aircraft. In some embodiments,the indicators are powered using a back-up power supply.

The drone 100 can be configured to use different indicators in differentscenarios. For example, the drone 100 can be configured to use audioindicators during daytime, and audio and/or visual indicators duringnight.

Further, at block 2220, the communication system 150 can also beconfigured to adjust the indication, e.g., vary the strength of theindication, based on various factors, e.g., the altitude of the drone,presence or absence of humans in the vicinity of the landing location.For example, the drone 100 can be configured to increase the volume ofthe audio signal, increase the intensity of the light, or flash thelight more rapidly as it approaches the landing location. In anotherexample, if the drone 100 does not detect any person or objects in thevicinity of the landing location, it may turn off or decrease theintensity of the signal as it approaches the landing location. The drone100 can use one or more sensors onboard, e.g., video camera, motionsensors, to detect the presence of any human and/or an object in thevicinity of the landing location.

The PDS 190 can act as an active safety system of the drone 100, whichhelps in ensuring that a flight of the drone 100 over humans orproperties is safe for the humans and/or properties even in the event ofa failure of the drone 100. In some embodiments, the drone 100 has apassive safety system, e.g., polycarbonate-based or padding such asfoam, on the underside of the drone 100. The passive safety system canreduce the risk of a serious injury in an event the drone 100 lands on aperson and/or property. The padding can be of various forms. Forexample, the padding can be made of vinyl nitrile foam and can besimilar to the padding used inside a football helmet, e.g., typically4-5 cm in thickness. In another example, the padding can be ExpandedPolypropylene (EPP) foam. In still another example, the padding can beExpanded Polystyrene (EPS) foam. In yet another example, the padding canbe an inflatable air cushion. The air cushion can be permanentlydeployed (e.g., like an inflatable seat cushion) or can be deployed,e.g., like a deployable airbag in response to a trigger event, such asdeployment of the parachute 125.

In some embodiments, the thickness of the padding can be proportional tothe center of gravity of the drone 100. For example, the padding isthicker at an area closer to a center of gravity of the drone 100, orrepresentative of a thicker foam of lower density. Having the thicknessof the padding proportional to the center of gravity can reduce the riskof a serious injury in an event the drone 100 lands on a person afterthe parachute 125 is ejected. In some embodiments, the passive safetysystem can be incorporated into an airframe of the drone 100. Thepassive safety system or a portion thereof can be removably attached tothe drone 100.

FIG. 23 is a block diagram of a computer system as may be used toimplement features of the disclosed embodiments. The computing system2300 may be used to implement any of the entities, components orservices depicted in the examples of the foregoing figures (and anyother components and/or modules described in this specification). Thecomputing system 2300 may include one or more central processing units(“processors”) 2305, memory 2310, input/output devices 2325 (e.g.,keyboard and pointing devices, display devices), storage devices 2320(e.g., disk drives), and network adapters 2330 (e.g., networkinterfaces) that are connected to an interconnect 2315. The interconnect2315 is illustrated as an abstraction that represents any one or moreseparate physical buses, point to point connections, or both connectedby appropriate bridges, adapters, or controllers. The interconnect 2315,therefore, may include, for example, a system bus, a PeripheralComponent Interconnect (PCI) bus or PCI-Express bus, a HyperTransport orindustry standard architecture (ISA) bus, a small computer systeminterface (SCSI) bus, a universal serial bus (USB), IIC (I2C) bus, or anInstitute of Electrical and Electronics Engineers (IEEE) standard 1394bus, also called “Firewire”.

The memory 2310 and storage devices 2320 are computer-readable storagemedia that may store instructions that implement at least portions ofthe described embodiments. In addition, the data structures and messagestructures may be stored or transmitted via a data transmission medium,such as a signal on a communications link. Various communications linksmay be used, such as the Internet, a local area network, a wide areanetwork, or a point-to-point dial-up connection. Thus, computer readablemedia can include computer-readable storage media (e.g.,“non-transitory” media) and computer-readable transmission media.

The instructions stored in memory 2310 can be implemented as softwareand/or firmware to program the processor(s) 2305 to carry out actionsdescribed above. In some embodiments, such software or firmware may beinitially provided to the processing system 2300 by downloading it froma remote system through the computing system 2300 (e.g., via networkadapter 2330).

The embodiments introduced herein can be implemented by, for example,programmable circuitry (e.g., one or more microprocessors) programmedwith software and/or firmware, or entirely in special-purpose hardwired(non-programmable) circuitry, or in a combination of such forms.Special-purpose hardwired circuitry may be in the form of, for example,one or more ASICs, PLDs, FPGAs, etc.

Remarks

The above description and drawings are illustrative and are not to beconstrued as limiting. Numerous specific details are described toprovide a thorough understanding of the disclosure. However, in someinstances, well-known details are not described in order to avoidobscuring the description. Further, various modifications may be madewithout deviating from the scope of the embodiments. Accordingly, theembodiments are not limited except as by the appended claims.

Reference in this specification to “one embodiment” or “an embodiment”means that a particular feature, structure, or characteristic describedin connection with the embodiment is included in at least one embodimentof the disclosure. The appearances of the phrase “in one embodiment” invarious places in the specification are not necessarily all referring tothe same embodiment, nor are separate or alternative embodimentsmutually exclusive of other embodiments. Moreover, various features aredescribed which may be exhibited by some embodiments and not by others.Similarly, various requirements are described which may be requirementsfor some embodiments but not for other embodiments.

The terms used in this specification generally have their ordinarymeanings in the art, within the context of the disclosure, and in thespecific context where each term is used. Terms that are used todescribe the disclosure are discussed below, or elsewhere in thespecification, to provide additional guidance to the practitionerregarding the description of the disclosure. For convenience, some termsmay be highlighted, for example using italics and/or quotation marks.The use of highlighting has no influence on the scope and meaning of aterm; the scope and meaning of a term is the same, in the same context,whether or not it is highlighted. It will be appreciated that the samething can be said in more than one way. One will recognize that “memory”is one form of a “storage” and that the terms may on occasion be usedinterchangeably.

Consequently, alternative language and synonyms may be used for any oneor more of the terms discussed herein, nor is any special significanceto be placed upon whether or not a term is elaborated or discussedherein. Synonyms for some terms are provided. A recital of one or moresynonyms does not exclude the use of other synonyms. The use of examplesanywhere in this specification including examples of any term discussedherein is illustrative only, and is not intended to further limit thescope and meaning of the disclosure or of any exemplified term.Likewise, the disclosure is not limited to various embodiments given inthis specification.

Those skilled in the art will appreciate that the logic illustrated ineach of the flow diagrams discussed above, may be altered in variousways. For example, the order of the logic may be rearranged, substepsmay be performed in parallel, illustrated logic may be omitted; otherlogic may be included, etc.

Without intent to further limit the scope of the disclosure, examples ofinstruments, apparatus, methods and their related results according tothe embodiments of the present disclosure are given below. Note thattitles or subtitles may be used in the examples for convenience of areader, which in no way should limit the scope of the disclosure. Unlessotherwise defined, all technical and scientific terms used herein havethe same meaning as commonly understood by one of ordinary skill in theart to which this disclosure pertains. In the case of conflict, thepresent document, including definitions will control.

I/We claim:
 1. A drone comprising: a lift mechanism configured to liftand propel the drone; an error detection circuit configured to: detectan error in operation of the drone, the error indicating a failure ofthe drone, and upon detecting the error, send a trigger event; aparachute securely attached to the drone and configured to slow a decentof the drone when deployed; a parachute deployment mechanism configuredto release the parachute in response to the trigger event, or inresponse to another trigger event generated in response to a commandfrom a base unit operated by a remote user; and a cut-off circuitconfigured to control the lift mechanism in response to the triggerevent.
 2. The drone of claim 1 further comprising: a first power sourceconfigured to power the lift mechanism.
 3. The drone of claim 1 furthercomprising: a second power source configured to power the errordetection circuit.
 4. The drone of claim 3, wherein the second powersource is further configured to power the parachute deploymentmechanism.
 5. The drone of claim 1, wherein the parachute is securelyattached to the drone by being permanently attached to the drone.
 6. Thedrone of claim 1, wherein the parachute is securely attached to thedrone by being interchangeably affixed to the drone.
 7. The drone ofclaim 1 further comprising: a navigation circuit configured to navigatethe drone from a first location to a second location.
 8. The drone ofclaim 7, wherein the first location is a present location of the drone.9. The drone of claim 1 further comprising: a video system configured tocapture an image from the drone; and a communication system configuredto transmit the image to the remote user.
 10. The drone of claim 1further comprising: a communication system configured to communicatewith the base unit operated by the remote user.
 11. The drone of claim 1further comprising: a parachute controller configured to steer the dronewith the parachute deployed and by steering the parachute.
 12. The droneof claim 11, wherein the parachute controller is configured to steer thedrone autonomously using one or more of multiple sensors on board thedrone and a steering logic of the parachute controller.
 13. The drone ofclaim 11, wherein the parachute controller is configured to steer thedrone based on a command received from the remote user from the baseunit.
 14. The drone of claim 11, wherein the parachute controller isconfigured to steer the drone to a specified location based on a videofeed received from a video camera installed onboard the drone.
 15. Thedrone of claim 1, wherein the error detection circuit is configured todetect the error when there is a loss of heartbeat signal from a flightcontroller of the drone.
 16. The drone of claim 1, wherein the errordetection circuit is configured to detect the error when there is a geofence breach by the drone.
 17. The drone of claim 1, wherein the errordetection circuit is configured to detect the error when a tilt of thedrone exceeds a specified value.
 18. The drone of claim 1, wherein theerror detection circuit is configured to detect the error when a tilt ofthe drone exceeds a specified value for a specified duration.
 19. Thedrone of claim 1, wherein the error detection circuit is configured todetect the error when a speed at which the drone is descending exceeds aspecified value.
 20. The drone of claim 1, wherein the error detectioncircuit is configured to detect the error when an ability to communicatewith a control station is lost.
 21. The drone of claim 1, wherein theerror detection circuit is configured to detect the error when there isa power loss to the drone or a charge in any of multiple power sourcesof the drone is below a specified threshold.
 22. The drone of claim 1,wherein the error detection circuit is configured to detect the errorwhen there is a collision between the drone and another object.
 23. Thedrone of claim 1, wherein the error detection circuit is configured todetect the error when there is a loss of flight control.
 24. The droneof claim 1, wherein the error detection circuit is configured to detectthe error when there is a failure in the lift mechanism.
 25. The droneof claim 24, wherein the error detection circuit is configured to detectthe failure in the lift mechanism when there is a failure in all or asubset of motors of the lift mechanism.
 26. The drone of claim 1,wherein the parachute is steerable.
 27. The drone of claim 1, whereinthe parachute deployment mechanism is configured to release theparachute without requiring power from a power source that suppliespower to the drone.
 28. The drone of claim 1 further comprising: acommunication system, wherein the communication system includes a twoway radio, configured to communicate a status of the error detectioncircuit to the remote user.
 29. The drone of claim 1, wherein thecut-off circuit is configured to include an onboard “kill” switch thatis configured to control the lift mechanism in response to the triggerevent.
 30. The drone of claim 29, wherein the onboard kill switch ispowered by an independent power source.
 31. The drone of claim 1,wherein the cut-off circuit is configured to control the lift mechanismby disabling the lift mechanism.
 32. The drone of claim 31, wherein thecut-off circuit is configured to disable the lift mechanism bysubstituting a throttle signal to the lift mechanism from a flightcontroller with a zero throttle signal.
 33. The drone of claim 31,wherein the cut-off circuit is configured to disable the lift mechanismby breaking an electrical connection between a power source of the droneand the lift mechanism.
 34. The drone of claim 31, wherein the cut-offcircuit is configured to disable the lift mechanism by breaking anelectrical connection between a speed controller and a motor of the liftmechanism.
 35. The drone of claim 31, wherein the cut-off circuit isconfigured to disable the lift mechanism by disconnecting a power sourceof the drone using a spring loaded mechanical switch.
 36. The drone ofclaim 31, wherein the cut-off circuit is configured to disable the liftmechanism by failing a subset of multiple motors of the lift mechanism.37. The drone of claim 36 further comprising: a flight controller,wherein the flight controller is configured to: readjust a load on aremaining of the motors that are not failed, and land the drone usingthe remaining of the motors.
 38. The drone of claim 1, wherein thecut-off circuit is configured to control the lift mechanism before theparachute is deployed.
 39. The drone of claim 1, wherein the parachutedeployment mechanism is configured to receive the trigger event from anonboard “kill” switch that is activated from the base unit by the remoteuser.
 40. The drone of claim 1 further comprising: an airbag deploymentmodule to deploy an airbag in response to a specified trigger event, thespecified trigger event generated by the remote user or automatically bythe airbag deployment module based on an indication that an impact ofthe drone upon landing exceeds a specified threshold.
 41. The drone ofclaim 1 further comprising: a passive safety system.
 42. The drone ofclaim 41, wherein the passive safety system is a layer of paddingunderneath the drone.
 43. The drone of claim 42, wherein the passivesafety system is made of foam.
 44. The drone of claim 42, wherein thepassive safety system is incorporated in an airframe of the drone, andwherein the passive safety system or a portion thereof is removablyattached to the drone.
 45. The drone of claim 42, wherein the paddinghas a thickness that is proportional to a center of gravity of thedrone.
 46. The drone of claim 42, wherein the padding is an inflatableair cushion that is permanently deployed.
 47. The drone of claim 42,wherein the padding is an inflatable air cushion that is deployed inresponse to a specified trigger event.
 48. A method of deploying aparachute of a drone, the method comprising: detecting an error inoperation of the drone while the drone is in flight; determining whetherthe error is of a type that requires a deployment of the parachute; andresponsive to the determination that the error is of the type thatrequires the parachute to be deployed, sending a zero throttle signal toa lift mechanism of the drone that renders the drone unflyable, andsending a signal to a parachute deployment mechanism on the drone todeploy the parachute.
 49. The method of claim 48 further comprising:steering the parachute to navigate the drone to a specified location.50. A base unit for deploying a parachute on a drone, comprising: acommunication system configured to send and receive instructions fromthe drone; an auto deployment switch configured to enable or disableauto deployment of the parachute on the drone in response to a failureof the drone; an arming switch configured to enable or disable manualdeployment of the parachute from the base unit; and a deploy switchconfigured to send a signal to an onboard “kill” switch on the dronethat, when activated, causes the drone to: control a lift mechanism ofthe drone by stopping one or more motors of the lift mechanism, anddeploy the parachute after controlling the lift mechanism, wherein thedeploy switch sends the signal if the arming switch is enabled and whenthe deploy switch is activated by a user.
 51. A method of deploying aparachute of a drone, the method comprising: receiving a command at thedrone from a base unit operated by a user for deploying the parachute,wherein the command is received from the base unit in response to theuser activating a deploy switch at the base unit, and wherein the baseunit and the drone communicate via a satellite or radio signals; andactivating an onboard “kill” switch of the drone in response toreceiving the command, the “kill” switch configured to: control a liftmechanism of the drone by substituting a throttle signal to the liftmechanism with a zero throttle signal for terminating a flight of thedrone, and send a signal to a parachute deployment mechanism on thedrone to deploy the parachute after controlling the lift mechanism.